The Online Safety Act landed in the UK in 2023 with clear intent: to make the internet a safer place, especially for children, by tightening the rules for tech companies. The act aimed to address harmful content and protect vulnerable people online. As part of the measures, in July this year, it became mandatory for sites serving up adult content to robustly verify the age of users.
As is often the case with sweeping new laws, there have been some unexpected side effects - one being a huge spike in VPN use across the country. This will likely present increased and novel challenges for law enforcement. Furthermore, the increased use of ID verification services for adult content may present an appealing target for cybercriminals.
What are VPNs?
A VPN, or Virtual Private Network, is a privacy tool. It lets users connect to the internet through a secure, encrypted tunnel, hiding real IP addresses and making it look like users are browsing from somewhere else, including other countries. This means online activity is much harder to track, whether by cybercriminals, your internet provider, or governments. VPNs are popular for getting around geo-blocks and censorship, but for many people, it’s all about keeping their browsing private and their data safe from prying eyes.
The benefits of VPNs
It’s worth noting that VPNs aren’t just about circumventing restrictions. They are widely used for legitimate reasons, such as protecting sensitive information when using public Wi-Fi, enabling remote work securely, and helping people in oppressive regimes access unbiased news and essential services. For many, VPNs are simply a practical way to safeguard their businesses or protect personal privacy and security.
Why are more people using VPNs?
Since the Online Safety Act came into force, VPN signups in the UK have spiked dramatically. Proton VPN, for example, saw a 1,400% jump in new users from the UK just minutes after the new measures came into effect.1 One reason for this is likely that people are uncomfortable with handing over personal details to third-party age verification services, especially for things like accessing adult content. Many do not trust these systems to keep their data safe and would rather use a VPN to sidestep the process. This is part of a wider trend whereby people are becoming more privacy conscious. VPN usage was rising even before the new measure were brought in.
New risks and challenges for authorities
But there’s a flip side. The more we rely on online identity checks, the more attractive a target they become for cybercriminals. If you’re handing over sensitive info to prove your age or identity, that data could end up in the wrong hands. The Ashley Madison breach back in 2015 is a classic example - millions of users of the illicit affairs website had their details leaked, leading to blackmail and a litany of reputational repercussions for those affected. Since then, ID verification services have also been breached, exposing everything from biometric data to financial records.
For the police, intelligence agencies, civilian investigators and lawyers, the VPN surge will present a challenge. VPNs make it much harder to trace online activity, which complicates investigations into cybercrime, terrorism, fraud and other illegal behaviour. Encrypted traffic and hidden locations mean criminals can operate with more anonymity, and there’s growing pressure on VPN providers to hand over user data - raising tricky questions about where to draw the line between privacy and security.
Looking ahead, we can expect VPN usage in the UK to increase further as people continue to seek ways to protect their privacy and bypass new restrictions. This trend may prompt further debate about the balance between online safety and personal privacy and could even lead to calls for tighter regulation of VPN services themselves. At its extreme, this would put the UK in the same bracket as many more authoritarian nations such as Russia, China, North Korea and Iran where state surveillance is far more intrusive and personal freedoms significantly lower.
Furthermore, it is almost certain that further ID verification services will succumb to malicious attackers itching to get their hands on highly sensitive personal data and the inevitable fallout from this.